Privacy Policy

1. Who we are

DalaDish is a product of MFH Technologies (Pty) Ltd ("MFH", "we", "us"). We are the responsible party for your personal information under the Protection of Personal Information Act 4 of 2013 (POPIA), which means we decide why and how it is used.

2. Who this notice covers

This notice applies to:

• adults who test the DalaDish app;
• the other people in a tester's household, including children whose details a parent or guardian adds;
• people who visit daladish.co.za; and
• people who email us.

Most of what we hold comes from you. Some comes from other people in your household: the person who set up the household chooses the budget, diet and allergies that everyone's plan follows. Our service providers also record technical details when you sign in or visit our website, as set out in part 9.

3. What we collect, why, and whether you have to give it

No law requires you to give us any of this information. Where something is needed to use DalaDish, we say so, and we say what happens if you leave out something optional.

4. Our lawful basis

• Running DalaDish for you, as our agreement with you (the Terms) needs: POPIA section 11(1)(b).
• Your consent to joining the test and to each optional item above: section 11(1)(a). You may withdraw it at any time. Withdrawing does not affect what we did before.
• Your explicit consent for health and religious information, which POPIA calls special personal information: section 27(1)(a).
• A parent's or guardian's consent for children's information: section 35(1)(a).
• Keeping your consent record, because the law requires us to be able to prove consent: sections 11(1)(c) and 11(2)(a).
• Keeping DalaDish and our website secure, and answering your emails, which is in your interest and ours: section 11(1)(f). You may object to this (see part 12).
• Sending information outside South Africa: section 72(1), explained in part 10.

5. Health and religious information

POPIA treats information about health (allergies, daily targets) and religious belief (a halaal, kosher or no-pork choice) as special personal information. We keep it only with your explicit consent, asked separately on the "Before you start" screen, and again at the moment you choose an allergy or a religious diet.

• We use it only to plan your household's meals and shopping list.
• Allergies and a religious diet are kept with your household's food choices, not against a named person, so that everyone's plan leaves them out. Everyone in your household can see them.
• Your daily targets are private to you. Nobody else in your household can see them.
• We never use it for marketing, never use it to decide which emails you get, and never sell it.
• It is stored only in Frankfurt, Germany. It is not sent to our service providers in the United States.
• Withdraw your consent any time in Me, then Your privacy choices. The plan stops using that information straight away. To remove it from our servers as well, change it in Me, then Household and food, or email privacy@daladish.co.za and we will delete it.

6. Children

DalaDish is for adults. Only people aged 18 or older may create an account. Children do not use DalaDish themselves; the adults in their household plan for them.

• We need only the number of children who eat with you, which does not identify any child.
• A child's first name is kept only if a parent or guardian consents, under section 35(1)(a) of POPIA. The adult who gives this consent confirms that they are the parent or guardian of the children in their household.
• We never ask for children's ages, birthdays, schools, photos or health details. Please do not upload photos that show children, or anyone else: food photos are for food.
• A parent or guardian can withdraw this consent in Me, then Your privacy choices, and ask us to delete a child's name.

7. What stays on your phone

• Your sign-in token, kept in the iPhone Keychain or the Android Keystore. Signing out removes it.
• Your date of birth, if you type it for the 18+ check. It never leaves your phone.
• The items you tick off on your shopping list.
• A store loyalty card number, once DalaDish lets you add one. It will stay on your phone only. We never ask for a PIN, or for any shop's or bank's password.

Deleting the app removes these from your phone. The beta does not read Apple Health or Health Connect, your contacts or your location. If that ever changes, we will ask you first and update this notice.

8. Who can see your information

• You.
• The people in your household, once its owner has let them in. They see the household's name, food choices (including allergies and a religious diet), plan, own recipes and food photos, and each member's first name, ratings and favourites. They do not see your email address, your daily targets or your privacy choices.
• Our service providers (section 9), only to run DalaDish for us.
• Nobody else, unless the law requires it, for example a court order or a request from the Information Regulator. Where we lawfully can, we will tell you first.

We do not share your information with retailers, advertisers or data brokers.

9. Who helps us, and where they are

POPIA calls these service providers operators. They may use your information only to provide their service to us. We use operators whose terms with us require them to keep personal information confidential and secure, and to give it the same or equal protection as this notice, as sections 20 and 21 of POPIA require.

When DalaDish is in the App Store, TestFlight or Google Play, Apple and Google handle downloads under their own privacy policies, as responsible parties in their own right. If you allowed it on your phone, they may pass us crash reports that do not identify you.

10. Information sent outside South Africa

Apart from emails in our mailboxes, we do not keep your information in South Africa. Section 72 of POPIA allows this when certain conditions are met. Ours are:

• European Union (Germany and Ireland). The EU's General Data Protection Regulation gives protection at least as strong as POPIA, so the recipients are subject to a law that provides an adequate level of protection (section 72(1)(a)). You also consent to it when you join the test (section 72(1)(b)).
• United States. Only what the table above lists: Resend's record of the sign-in emails we send you, website visit details, test app downloads and, later, notification tokens. These go under the providers' binding data protection terms (section 72(1)(a)). Sending your sign-in code is also needed to give you the service you asked for (section 72(1)(c)).
• Health information, religious beliefs and children's information are stored only in Frankfurt. We do not send them to any country without an adequate level of protection.

11. How long we keep it

12. Your rights and choices

Under POPIA you have the right to:

• Access: ask whether we hold information about you, which we confirm free of charge, and ask for a copy of it.
• Correction and deletion: ask us to correct or delete information that is wrong, out of date, excessive or no longer needed. The household owner can change the household's details in Me, then Household and food. Anyone can delete their account in Me, then Delete my account, or see Delete your DalaDish account.
• Withdraw consent: switch any optional choice on or off in Me, then Your privacy choices. The consents needed to take part in the test can be withdrawn by deleting your account.
• Object: object to us using your information for our legitimate interests (section 11(3)(a)), and to direct marketing at any time (section 11(3)(b)).
• Complain to the Information Regulator (see part 18).

To use any of these rights, email privacy@daladish.co.za from the address you use for DalaDish. We may ask you to confirm it is you. We answer within 30 days, and we do not charge you for your own information. You may use the Regulator's forms (POPIA Form 1 to object, Form 2 to correct or delete, or PAIA Form 2 to request a record), but you do not have to. Our PAIA manual explains formal requests for records.

13. How we protect it

• Row Level Security on every table in our database: each person can reach only their own information and that of the household they belong to.
• Encryption in transit (HTTPS) and at rest.
• Sign-in with a one-time code, so there is no password to steal. Your sign-in token is kept in the iPhone Keychain or the Android Keystore.
• Family codes stored only as a scrambled hash, at most 10 tries an hour per person, and the owner must let each new person in.
• Food photos in private storage, opened through links that expire after an hour. Location and other hidden photo details are removed on your phone before upload.
• Only the people who run DalaDish can manage our systems.

If we believe someone has reached your personal information without authority, we will tell the Information Regulator and you as soon as reasonably possible, as section 22 of POPIA requires. We will say what happened, what it could mean for you, what we are doing about it, and what you can do.

14. Emails we send

• Service emails: sign-in codes, and important notices about your account, the test or this notice. You receive these while you have an account.
• Our occasional news about DalaDish: only if you switch it on, on the "Before you start" screen or in Me, then Your privacy choices. We never base these emails on your health or religious choices. Every one says who it is from and has a free way to stop them, and you can switch them off in the app at any time.
• The test version sends no push notifications. If we add them, your phone will ask your permission first.

15. What we never do

• We never sell or rent your personal information.
• DalaDish has no adverts, no advertising identifiers and no tracking across other companies' apps or websites.
• There are no analytics or tracking tools in the app or on our website.
• We never ask for your password for any shop, loyalty programme or bank.

16. If DalaDish changes hands

If MFH Technologies, or DalaDish itself, is sold or merged with another business, your information may pass to the new owner, who must keep to this notice. We will tell you before that happens, and you can delete your account first. Any new use of your information will need your consent.

17. Changes to this notice

We will update this notice as DalaDish changes, for example when we add Apple, Google or cell number sign-in, or notifications. The version and date at the top show which version applies. We tell you in the app or by email before a change that matters takes effect, and we ask for your consent again where the law requires it.

18. Contact us, and complaints

Email our Information Officer at privacy@daladish.co.za, or write to MFH Technologies (Pty) Ltd, 874 Odell Street, Wingate Park, Gauteng 0181.

Please contact us first so that we can put things right. You may also complain to the Information Regulator at any time: